535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
Size 1.8MB
Sample260706-lpaedahs2q
SHA256 535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe
MD5 0bd656d6c9181cdf6d9bdbd9ddc33965
SHA1 bb231bdbd8041bc38c31247a710adb32b86abe5a
SHA512 7e60b758d222a9b0c9f99006eee25f49811e9101735e908c530108c98bc1f35c2df35ea767d5347da4ccf91e0a665a5f3becaf3b1c4efb494358358025b5fd9e
SSDEEP 49152:0o3GnmefTNeDe0737RM3fDruVeWnmO7qS/mLHxbc:0sGjTNeDe0z72fDreeSZ/shc
TLSH
T19395230274E28460FAB20F3055B846B2067DFC710E756B9F53E96A7D1F389C1A83976B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
964	alg.exe
5100	DiagnosticsHub.StandardCollector.Service.exe
3820	fxssvc.exe
2492	elevation_service.exe
3664	elevation_service.exe
1988	maintenanceservice.exe
2116	msdtc.exe
624	OSE.EXE
3292	PerceptionSimulationService.exe
1844	perfhost.exe
2772	locator.exe
2640	SensorDataService.exe
2820	snmptrap.exe
3936	spectrum.exe
4048	ssh-agent.exe
4908	TieringEngineService.exe
3700	AgentService.exe
3536	vds.exe
2444	vssvc.exe
4608	wbengine.exe
3308	WmiApSrv.exe
2404	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\msiexec.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\AgentService.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\vssvc.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ba0f4932e52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\vds.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\locator.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\spectrum.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\GoogleUpdateComRegisterShell64.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\GoogleCrashHandler64.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\goopdateres_ml.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\psuser_64.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\goopdateres_lt.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\goopdateres_am.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\goopdateres_it.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\goopdateres_sr.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\GoogleUpdateSetup.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUM4031.tmp\goopdateres_zh-TW.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f35d37c12b0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000436a2ebb2b0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c578f8b92b0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000067dbdbb92b0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000557555ba2b0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073eb6aba2b0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d223cc12b0ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc9c3dba2b0ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000044d4eba2b0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5100	DiagnosticsHub.StandardCollector.Service.exe
5100	DiagnosticsHub.StandardCollector.Service.exe
5100	DiagnosticsHub.StandardCollector.Service.exe
5100	DiagnosticsHub.StandardCollector.Service.exe
5100	DiagnosticsHub.StandardCollector.Service.exe
5100	DiagnosticsHub.StandardCollector.Service.exe
5100	DiagnosticsHub.StandardCollector.Service.exe
2492	elevation_service.exe
2492	elevation_service.exe
2492	elevation_service.exe
2492	elevation_service.exe
2492	elevation_service.exe
2492	elevation_service.exe
2492	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1032	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
Token: SeAuditPrivilege	3820	fxssvc.exe
Token: SeRestorePrivilege	4908	TieringEngineService.exe
Token: SeManageVolumePrivilege	4908	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3700	AgentService.exe
Token: SeBackupPrivilege	2444	vssvc.exe
Token: SeRestorePrivilege	2444	vssvc.exe
Token: SeAuditPrivilege	2444	vssvc.exe
Token: SeBackupPrivilege	4608	wbengine.exe
Token: SeRestorePrivilege	4608	wbengine.exe
Token: SeSecurityPrivilege	4608	wbengine.exe
Token: 33	2404	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2404	SearchIndexer.exe
Token: SeDebugPrivilege	5100	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2492	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 5072	2404	SearchIndexer.exe	112
PID 2404 wrote to memory of 3452	2404	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
"C:\Users\Admin\AppData\Local\Temp\535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:964

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2088

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1988

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2116

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:624

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2772

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2640

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3936

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4048

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1048

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5072
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 42149e651654a6a871b8e0a7ae4906ab15296afd7ed1d2a239daadb3bd9c4e9b
MD5 aba910c22eab2ac29e19416aee819569
SHA1 ad6b6955629d6fbf47e0f7e8c67a4a6b13e20a5a
SHA512 d156955bcefcff1b9d31052146b89cb5d51e2208031b15667e583a7036c4e55678c7a82c57790fe63d24662051a1619d93b9a96badfb1e03be5abacbcb03e250
SSDEEP 49152:mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnDmO7qS/mLHxbc:Y3q6HjBOZ/shc
TLSH
T14BD59C03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d18a084b07b74a51a03bb41711d937ce05aeb259d812f1854e0a4c93e07ea35c
MD5 66669ef00b1ae5cc0d2430f156ba1020
SHA1 20201b2bd7700217b6976b438c8e6e5db1ef9ef1
SHA512 f21c1a650c28cca20e3d5a47ec8ca1b1fff7f6d0343d805b6e62941d03062f908c5e3144bf2e590d7cb49f398d67685dc28f0c3cc23b2cd9cfd5215a8b353132
SSDEEP 12288:q1XLsswWkxy2lRq2czA5MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqm3:gXYfDtczAKUjO7l86h/GaYBBPrZNxbc
TLSH
T1AD65012977E408F9ED67823CC9A18116E672B8954760EB8F03E49A750F332D86D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 2f941e45302d54485f754f5a3df7584595be29bb3b14f2d3de925d0ccde082bb
MD5 d6987134517da7e0873de416ba5711f3
SHA1 841db802258dc6e4b4ef2e5bc515758d8af576fa
SHA512 7cddd92f6e5b3c5c3203a97800829ceb5ad4fe6cb7e41f9d06ba01cc709126cb595be78d480ec16956b2aebdddfbefd6c993224187f012bb1642da17383eb263
SSDEEP 24576:i0Le5ji0hmxirMLUjO7l86h/GaYBBPrZNxbc:iPji0Ac8mO7qS/mLHxbc
TLSH
T10A85AE26F5748335D073C0B9C5D2A69EE97130865B308ACB4286D77C2F6BBE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 46c771045e129bac1447126c8c811d7024db7ca5dd2b80040e4d62ab3df79379
MD5 7795b1c662962ba33a3679d5f37baaf9
SHA1 b248ba23194b14117c6782797b77c8d56931ea5e
SHA512 17ce10adb2b70d2f1aca14f80d3620e0324b9d53f03371de3e92ef59d9301d3e471ac8e532935decd8b2ab11cc7b95781c4d66989a0a5c5e1d7162315be90621
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyuJUjO7l86h/GaYBBPrZNxbc:k/ezSC6vUzPvxHjy4mO7qS/mLHxbc
TLSH
T1AB755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3dd15b572df3b8fd7a394578d2f18c5fbe5fbb976476c93e910115b3bf1b3804
MD5 d1c59d2f8a816e54717c4261779c6b8d
SHA1 c880a3e8e87004fa235a80e40bbed543d35bf80a
SHA512 76a1b5a935f81e28c778914d329dcda49e422e92cd736ee580a4068c00105162d46a13f2965b3216c7bccedd8435593580a9ff7ce7a730290726c85191065423
SSDEEP 24576:LVbqPb88hv/l+6eUjO7l86h/GaYBBPrZNxbc:LVO88hXl+HmO7qS/mLHxbc
TLSH
T15D559E66F5748331D073C0BAC5D29A9AEE3230425B318ACB1246D76C2F677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4dd6599a1cb162531379ed6312fa1760a8ed65b805bf25aa025913f175768f3a
MD5 e2de4d4ed9258108bf5aa1e4310689ef
SHA1 cec629148b043702310aeb31e708778db6694be4
SHA512 e9e9fa4523e6c8d6e193148d533f6fdf756e00e7550f7af33f57f6af2d79b9fd1f4812f7153ca35422ee8a39c0b26f5a80e016bb8100fcdfff10761812e743eb
SSDEEP 12288:xRgMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:xR/UjO7l86h/GaYBBPrZNxbc
TLSH
T158452317BC5448C5FF0A8E71F294006B40E0A4B99D16AD0FA2B9BFE4477E4E1F47E949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c8109cf5a2acf07c398d955b9a69f29e348b6a3fed84e49ac960ee4596a82b89
MD5 da0fd5c8b925ba3b7def3dd9e6276f43
SHA1 f3cd14d73c733732ecaff149f1ced9863a7f18a2
SHA512 f5c5594dd75084b097ef528debeed42eca9995e61b29e42a0b689ceccef7f63a2cd64f814c8a23a3905406b3bed9f84e76dd5f82263e3b752d976426453d8bc1
SSDEEP 12288:YeBNUbTVO86UVMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:YJIUmUjO7l86h/GaYBBPrZNxbc
TLSH
T12565CF3BEE28ECD2C67E8DB95691820097B274704F62A3CBD175830ECE275E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eaadd6025395e065fd6ed007e0b953394182847d7a5db22e706c0f9f4f82681e
MD5 c3d6a88292a33a19ed73edbef58dc931
SHA1 82995415a0914412b5e1d7eaf418827e33ddd82a
SHA512 25ac062cdb813b61dc946ebe51efc257079d0b9f37234846646e7900120d3c424f7746bd116c52afd7262c386a7c4d93cb4f6b470784647e9418593db09321a2
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THE:OQvGAdlCEL8c/yRNw5CZZ/shc
TLSH
T171267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 38ad93c578de386ded0d6cef87535e771370d4954158b2239df82b523da7e993
MD5 ba96ab226794892f7153ff957415fa07
SHA1 2b958c8a8fcc2339a8f4bd222e3188700c57977d
SHA512 c25de31870b48076f3553e86c72c5fc186b78cdcf7a9683894c8b20cb1b7a739d2e179340dea204b2ed1213aeffa1d57a9176250bbff72204151df014ea539e1
SSDEEP 12288:GAwSfxL/2Dc34DLLmt0LDQewsAjnMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JU:bdewsAjMUjO7l86h/GaYBBPrZNxbc
TLSH
T10F75E031FE74D436C77B0DB21B25C716146CB9604F621AC3E3A89E9D4A342D2277AE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dfbfe7fff7fa53e03cb66abab315690d7f591e90db3fce740c514b8fbce905d7
MD5 5c32a47ac7d1fe3a3894e418c222f8d1
SHA1 53bd9f77b06c4c9af1d5d2185678001a6bc6998f
SHA512 98e863d41a864b837931638cd50019b8fcf719bb0f144a8c639294740070e8247a7f8bfc554e3226dcf6da99d142442681d50639dbda7d8be7bbe17c8e40ead4
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHAshc:9UEtQevvqc2W1cpV2EI32
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ef6f76ff93c18edb3a5fbb306f61a17bd44ea03758de4f23345a1bdbfe3ef8a6
MD5 d462bd57db1cf5c84c1b684277f39f08
SHA1 987d712bcbb2fd6da802f268d8aecdb81df89134
SHA512 3642dda725da7a58a54f5019254cd5fe878acb62d2076a848710b6508d6563fa6645efed8837424a6365088aeb8cfd2be4212e4c40e643eb1306724e6f640068
SSDEEP 49152:QCbRquA/m2yL5zQfFiV+XenmE3/zsmO7qS/mLHxbc:5oqtVjnm1Z/shc
TLSH
T1F7D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 22d225c1829116388834c1be6eed08d243fa42989da6f8f580a16e7b389d1be2
MD5 09f79ac04cf34af5cb776f5cadcbb1e7
SHA1 0843f3a8ad7a28da7ad63d19805197ece854e989
SHA512 f34085cbde6e999dcf93231787a04f7e62ff1c60152023a310f8bf142f963e6a80dfd7775757f7a04286e7808bf5896b57e2845d754e9201d9df5652db02af5a
SSDEEP 24576:oAhGLJIFoiwtA5l7S53VUjO7l86h/GaYBBPrZNxbc:oAMyFoiq5FmO7qS/mLHxbc
TLSH
T13635AE81EBF945D4F5B3AA7899B68171EA76BCA65E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6b73f527a7035daf8a863e570c7ed59a86f1420397b9683e7fc498cd76cb47e9
MD5 bc13388ab7606f1ef803a685933262a5
SHA1 0a7f831c58c464787f6c402195cad21d025bd1ed
SHA512 780417364b8056e38bd5f387660c660d6dd0033f265480346843405d3311376b8358ab56a1495204f205bf5cc2a9f1c0725a7d76b59df7d9a3076325b460fbb6
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+COMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYj:OwuoOWYUjO7l86h/GaYBBPrZNxbc
TLSH
T14465F14676A40CF9E9678639C6978136E3F2B8122A25DB0F1370C75B5F37261BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 be595155e16e21a51d6d7555cfd2493d6880cfe68945bce6d695da6aec0f34f7
MD5 061901930770fc8bc9e61d0a019a6a78
SHA1 aa62a0ae28c51ab1f36e5e7d112c0f3ef373495d
SHA512 db7490f606db328109626493215a21d551040fcaefeba60e8f7503cb0bdd187222bd3385f60684f42f01082ba8d10dacdfb160ef60987979b5262b4638454fe0
SSDEEP 12288:XBZ1IyXMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:xZuTUjO7l86h/GaYBBPrZNxbc
TLSH
T16155235A3AE420F9E657867DD9E0020BC3B070A6673657CF127947A90F37AD26C3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cd70af63dbb960d38412e5edcf9c60112e52c0cbba9b7a4c6ed0b04a61c82155
MD5 2c6af246aa5276eb8dc26f78e364d2eb
SHA1 a6ddacab276462843e706615b940a209f9eab28e
SHA512 ba810b36a75291b036ab7a52656dca2ad69819a0d7b6e22f7de252de07f9437db4b8a86eb7e53c29b3ee00fc7f66cf0a43867f740bc0c896fc06175b24007ffa
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:1QRQyi36YOcPQLvw2gAf+PN3yZ/shc
TLSH
T171667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f54ee7480ec3b2101c77c7dc4d238185c267df5b3e148e4e4666f1fa75adb373
MD5 f51d6d10f596312af1d7645ab9c24a11
SHA1 d3f48793db8d26a9646fa49432e53ca78ae3ca29
SHA512 4b85009b0b891d6e19f455e3d973fd9592a63cc2e4fb04149bd307c8fb8eec076ed3efe7ba922d7e6179de8375d21773e6b9c6a6515af4657bd18326a962b907
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:yQRQyi36YOcPQLvw2gAf+PN3yZ/shc
TLSH
T1D6667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 df259c980e087183e3c84a310e5868bcd18066f414eb80f396e6149921ffe36a
MD5 eb92bb6d8c53a8e3d57be24da8fd1d8c
SHA1 5c53c09e6e6932bc30645123c533722a46823122
SHA512 d8bf6af17421dd955dd9d782fa3d079ca99982adc59c998d77894a2ad80faa5bd061586aadc6e24c049d873caebc96f59ed9005738a2c232074bbd910b93c15d
SSDEEP 49152:468Qg55nhheWu7PNU3/8mO7qS/mLHxbc:CthWRc/8Z/shc
TLSH
T169B55933B2F200A9C44DE1769F4A873296D17C758FE1E3DB811572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 78597042bc243090ce9678ab374c38ab3538eab3e11131d49a56cbe41ec5a694
MD5 8fe2c2f241683b80da0408098213f470
SHA1 e829c421ae0f027608ed2f115725760416c8c7e4
SHA512 2e27f5df5c71e2778a6b44b25544757e3d0b3218a81af95a45237ff4a1bd365ba4357d76b012f10ed741f9085238fe2c5f00766eb5e8052dd8979faa13ea8a1a
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:Wy5112gYy5azzVvL69nLKnhZ/Z/shc
TLSH
T17A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 00ba4cf9573480793bd6c19705f86f426cbf27730b79705af09603a1e544e788
MD5 c72d4c5ee4f07f923ec9eefd29d995eb
SHA1 8f4b54396f90f3a64108f88c463a760ab3da002a
SHA512 014b94c97bb05b2e25c455a6532f56610457aac33423ae9c3a3043d93a2d9c2fed60a8a83677ca666d37ee150403a55cb948cc3a41436695cbb241e8957c323c
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6mO7qS/mLHxbc:Cu6JmVxd2d6Z/shc
TLSH
T114D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f050a5f36216e4a498c6606652df63466238afb081f5357325af0588aa0deb47
MD5 314255fc79f8803163c4a6329cb8ee93
SHA1 9cb52938211751b7ac55dd532eee8ae0f2dd097e
SHA512 2a0e769da5b73ab926d35886fcebb986dcf32a131ba0cf3f438a34ea05f1a564a1cf756d08f2bf6dff388508c9418b4cb697879dd6dd135970bc9045661ca552
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4xGmO7qS/mLHxbc:8mifPbR1Z/shc
TLSH
T1CAB5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 83b53f59fbb9dd14177b8fe94e7e8dfc73c851b73659eb67daebff2c21463fc9
MD5 fd7ed69566242da393f6c1887cf03ccc
SHA1 e092a1121c3571e2eb619ad9758082359fb9eaa9
SHA512 6195262912fec5b840a9b2276f7a09c3e224df76310bb71e669e8ad89321fa953943819ef6cd5db6565885b071aef7824780fc79f9fe048517f7ce1ad4e01a08
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHqTmO7qS/mLHxbc:d5dKTi61TZ/shc
TLSH
T199C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 afbbaabb9c9783a445ceb8dba5b9e52c00a1e2dbd58338f49c625ee1ed6f06b8
MD5 09b7d8c9a5d8004b6c0ac362dd404521
SHA1 60502fb138f6e28451214c6a33d8f71af4e57852
SHA512 589a42fd7cacefd988053722cd82e74cd27dca74517224c7c9a34f66ae193c73e470afd2b69bba63daabe5c8862798693a58de1c55482d8a7f4efdb65c4ea3e6
SSDEEP 49152:3htSn8EApI0figngiDn0AP5wKmO7qS/mLHxbc:mX2iyphxZ/shc
TLSH
T13C95BE13F2D900E8D05ED178C7468632E962BC160B39AADF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 05b2f433b50da15f008efd574bce66e1db6e15a54e84e343c8dc22bccdedc016
MD5 8b031e5e6f8805bd08260c87335d5284
SHA1 1bcc88c6d5aeb043fc3909b2cd1884ebda5fec72
SHA512 5b12f5f63fe8b07c97f5d37bb6bf8acf4b97b070bdaacbf3daa1ea7902fbf3191987565823f406b8f04b1d38f5acadc7d1ab37da40971f563b1ebc355f3059a6
SSDEEP 12288:WYMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:WHUjO7l86h/GaYBBPrZNxbc
TLSH
T17C452316BC6548CAEF09CE71E280016B40D4A0EABF176D4FB3AD6A60477E4E5747ED8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 21edab0103b20c186e6a6065d22e80e06698696a4fb9779595603ae1cd3c6976
MD5 caa2883bb4403d1e8a253d0b31031e91
SHA1 3d4e13ae293814572c73b311f618aa6c1cb24053
SHA512 0207226fda5a9cf7b9ab4b3258be9d8023d90332e1bcbc936ab4ba150bc1cda6f52b52cef2a3e91a98dc155f673debad6097d5d1a841a7e191526fc37aa31082
SSDEEP 12288:G7MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:GwUjO7l86h/GaYBBPrZNxbc
TLSH
T161452316BC6548CAEF09CE71E280016B40D4A0BABF176D4FB3ADAA60437E4E5747DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6c9ef4dc00e4fd49328d595e909c3265d61b44b8a7b72f0c39828dc16f8f1105
MD5 59407a608229f905e8212bb4524fa01c
SHA1 145e83a3900f555ba040ea30eec8800c9900407e
SHA512 3dc8ab392558435fcd2b201b99a94fe7005163e4f34473b6dfd8e11075c5b7cdb612f063034d963fd17bc6133b33f55434315527f82acef6bd825d1ff2b3a43f
SSDEEP 12288:xNMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:xOUjO7l86h/GaYBBPrZNxbc
TLSH
T161452316BC6548CAEF09CE71E280016B40E4A0EABF176D4FB3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6e30b350e14a9a2126524c136b459a245e2b57b6fa271780937d95e84a16cb0f
MD5 fbb457bcaf7462f6143de2dacb11e8b1
SHA1 e4c57dead11867d6ad7a1a8ec31a897dc890c4c5
SHA512 7c59b3ede87e2efd073b2b3269d17a0f1b3b0e39dac479a859c9a97e551adf0d9fcdb729f306ec19012193d56b842dbd1ef13514611c9532d23df644360456ae
SSDEEP 12288:XV6MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:nUjO7l86h/GaYBBPrZNxbc
TLSH
T1E14523067C6944C6ED16CB71D690016BC1F0B4F9AB33AA8FA3551EA40F7A6E0783DF58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2f1955bad05dbfe67447cce41795916584df1816db8a4c6ce963ccdc9dca5b23
MD5 99505efbc7bab756152b673d2fb11be3
SHA1 9fff862beec9c59f4d52681382fe4af03cf0d786
SHA512 7717c8738a8d89c3c2fa00c6c34900cf8d05d5b6592be057b5c338204de5c587346e1da6385ac75a8ceb061ed089f0ae4b75b41f81dd104aa686a19fb1e18b31
SSDEEP 12288:SCMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:SNUjO7l86h/GaYBBPrZNxbc
TLSH
T19E452316BC6548CAEF09CE71E280016B40E0A0EEBE176D4FB3AD6A60477E4E5747DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cb2320103f6af588cc1816fb22a8f33193db980e74cfbf8e317d77d004b33fe9
MD5 41d90286b6aa8221fb1e4d7f9f97951c
SHA1 4ead329c824c3c7b0d23d9ec62cb3afa2386ffc6
SHA512 fc96d7946daabaef7f2a3803b7f6d2f405da7e6a96eb404aab97b17e5984787cd5c0f6627c6a7938464c9f3fc024ab77040a0ee0de79d656bda618a28373246f
SSDEEP 12288:d/MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:d0UjO7l86h/GaYBBPrZNxbc
TLSH
T151452316BC6548CAEF09CE71E280016F4090A0FAAE17694FB3ADAA60437E5E5747DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6e9f31c20f70bc392561461da0ceffffe2d9a40790781c3a2a8819907d3ede34
MD5 7f9a5d67e3270f205eeead67bca2c4ba
SHA1 21773398d0db01abf29626eda623b0a599a19eb9
SHA512 5ae45a06fc745c9a48855e35d3667fa683b6bd24aab300a25b3aa7d0091f68c413f7e1545a30369549b6a8c4e4c1c5a4bc97ef7697b99c5c2a73472d74f76d5c
SSDEEP 12288:jDMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:jIUjO7l86h/GaYBBPrZNxbc
TLSH
T1DF452316BC5548CAEF09CE71E280016B40E4A0FEAE176D4FB3ADAA60437E4E5747DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8ea12ae1bbc5faa971d87e29e3cbed01ff2ff296fd6108d44be63b6a61b4f9b5
MD5 6a52a0385dccdd255c18a54c84d4d46c
SHA1 8b553579021f89ac05772a473a3e5ae0fc2b9068
SHA512 875f5bc3d5fceccb314f540e09b58d70154bc05b7558c0de3840f50fc84b6d303d9cefb868de658a86b309486327a1d109caa498a2d88d6b947fc9dec447437d
SSDEEP 12288:AiZwb6zzFEoS2cPvybMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:DZMSzFVSOQUjO7l86h/GaYBBPrZNxbc
TLSH
T1DD65F195B6900CF8ED67863EC9554916D2B1BC6A0B60CA0F13F836664F373A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2a4f0247cdecb2b334665e3a89e62c18b1ca9b8876e5d3455b848bb001a8ff16
MD5 1e763e5268b89fa303a2c2d295d2a379
SHA1 b653f8ef726d68b75e839265a9a8152d50a33da9
SHA512 a4eb38de54e18276d1228fbb31e96bc17a8f9f393f592f17b282aa44512dc963ca4219506cb43d92a1d9839b7ed4e0a05c2d65bd2e651875f6eaaf0a3b210774
SSDEEP 12288:pUMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:pjUjO7l86h/GaYBBPrZNxbc
TLSH
T121452316BC6548CAEF09CE71E280016B40E4A0FEBE176D4FB3AD6A60477E4E5747DC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c7f0fd02f005d36283f71c8bae14a8c2ef384e6152ac899619bbabdb2986e6cb
MD5 2af950b352279104ff151b08f0c93426
SHA1 51491e484a922d52e2f976db6da38ddfa0ab9044
SHA512 e610d7cb44b808e0225b8a430312c59d102374d34f25a5116231ea8362e3799b4c9b5dd616b3b4a63f4c0efc8667d0fbdcc686befc8c3e90796c0683b96dcb44
SSDEEP 12288:8QMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:8PUjO7l86h/GaYBBPrZNxbc
TLSH
T189452316BC5548CAEF09CE71E280016F40E4A0EEBE17694FB3ADAA60437E4E5747DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f56cea7ea0ef752d8c644a73ab1a60531709bb8d665710d7596f1453133739d2
MD5 cfb4f46cdc07e97ab1dceb5ffaa35846
SHA1 2dc4129c8f734c798e272cfdf7fb9ef710034133
SHA512 da8f6a13eb95eea46056e4162cda5d762168d70024e9fd4a521b5464cc0382c178fb00927bb68d21654b648b61c2744fed630ed095d55155bb5376f588f845d1
SSDEEP 12288:MyPz5L8XMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:VzycUjO7l86h/GaYBBPrZNxbc
TLSH
T1795512077AA120FDD5278235C9910A17F3B0B4764B219E9F63A447761F3B6E1AC3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4f030e5a8669acc25057b1fe7e3f6d832a09d8e261d140985d7be3370146dc76
MD5 57f9202b226fc23bf2189a096d281847
SHA1 22a24f18636f58e1f44bf8d72e6b3f6e9077a750
SHA512 becad08d528214d1b5a3185f09c2fbb58840e1efbba2b36a9a8669ba3d31bf6827c21d6c00c9252f1e63bcccab13e4ab2f4b263b6ec3a9b059867c3ccdada3e1
SSDEEP 12288:yUMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:yjUjO7l86h/GaYBBPrZNxbc
TLSH
T171452316BC6548CAEF09CE71E280016B40E4A0EEAE176D4FF3AD6A60477E4E5747DC9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 48994eba8ade9747b9461c1987a8f809a54cc3cb63bfa0ee7bdb7cf86e60636d
MD5 b06363566f1cff8e94bd2d1ecd1f01e6
SHA1 d3554e95eb78241a72eaaf8a7ac5bb3e50f124ba
SHA512 58a7b43202a704940ba799a6000ef6258b000953a6e60f3adb3e4a0b0559b9677b96cf3d170c89f455884ff6422ba5efd518507e3d206098e31eca46d04e4064
SSDEEP 12288:2UMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:2jUjO7l86h/GaYBBPrZNxbc
TLSH
T19E452316BC6548CAEF09CE71E280016B40E4A0EEAE176D4FF3AD6A60477E4E5747DC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f2cf62a730a5ea73d5707827e7ff1531898f9a28ca6a04abc6c961d69ba6ad38
MD5 fc3c0779d916c204379737381a7db510
SHA1 c319e92de8b3905cfd3ae686a52857086e91b28c
SHA512 2c2bf6256706fbb2de0e3d762899a7243e22687028e499b1b371029c713ecc27da517de991e1558b1157070563c4ae8af382b8923273295b0bcad2dbc4d8205b
SSDEEP 12288:xyPz5L8XMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:gzycUjO7l86h/GaYBBPrZNxbc
TLSH
T1D25512077AA120FDD5278235C9910A17F3B0B4764B219E9F63A447761F3B6E1AC3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9bc97e8f00a88b92c399ba194878150be6c7f4d5a8f9f3028664a97a66d212ec
MD5 9b5df6068ea5e419c6c3393f58c1c259
SHA1 6574267c12f657608c0b1d83e520c30ec6d7674f
SHA512 d26a235ddd1bb9ceeb37f0bc2a82a16e93ebf7f27602c32be3587de3488141692b2a0b080e659b17b91a84338021095f3b336b6b6dfd041bfa4a01696a90eba2
SSDEEP 24576:HcP4mcvIjkGOxhKP2l71nNKbrh/8KB7UjO7l86h/GaYBBPrZNxbc:8P4m4IpOO67W8KZmO7qS/mLHxbc
TLSH
T19565AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CF1160933C3F77EE54E35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 83adf572a7dcdb62439fff785d3e5d6b7e1a23f6507f5146a2cb4307e896cbe7
MD5 4b83760e10a1e53c05ebc904c7ab2f3d
SHA1 3e107ee2920e48ae618b2ede8e51c86d2fa54800
SHA512 0c17699211b85718ab8fdb9489bd485d78f24d7e8040211eff07b5a6f8a2ce9d82ceadce5519236ae50ec14e0b4bc91c6f79d33b46d460d7dc1f58dd0d4da9d9
SSDEEP 12288:tNsfkMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:CTUjO7l86h/GaYBBPrZNxbc
TLSH
T17D55F00AE69802D8D46E9275C7410642B3737C6597E2D7CF62D0F97D0F7A6D0ACEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cdc75c4d746c6cbe1d00536fe09274c89695fa5b56d301009f8084c58453c376
MD5 221a728049eabb51c83a335ce2177654
SHA1 7cf8e2f9b8801b7cfcc454cde72b7b8b5200d0ba
SHA512 dede8e65974b43a38155c3eeb9af62880fb0d729a7e932b7dfffb377696c4f8ba780516269df2a6acd05c2ea0495faaedc0e4776050dab3964fa51bb949b55bd
SSDEEP 12288:pEMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:pzUjO7l86h/GaYBBPrZNxbc
TLSH
T101452317BC698CCAFA5ACF71A150013B0064B0B99F16A94FF25D6BA4477D8E1BC3DA0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 c2ad57308f33b6bae94fb383b3c1cf998768cf48386452670d54f52eaa65885f
MD5 5de5a3e2a14cfe996fbcd64558bb4fa9
SHA1 ed581c036561dcba23b261a7d662b86b0d15daed
SHA512 c2ef6834a4fb3edf9231a640f0af4a874d55323dbcb5d41d334dd6a2d1d81fc57d93e922ae04c68f7480a75de159dbe6984c9e403a6d60324f24de03f0b88d2d
SSDEEP 49152:ha0h2GEkuAe73q3pp46zwwQNmO7qS/mLHxbc:ha0hNYG4JwkZ/shc
TLSH
T12C859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 e6d19f943fdee8c1f188e5a78a7b7c2c14c6f508f461ca21494b61da50f6b2c3
MD5 7928bbfc9dd9bd31b9d7e33c6b50c979
SHA1 d957fd36f7c018dfd5a00818a5c301ad72cd75b0
SHA512 ceebebc19fde58ff6c86f904edec150707ca2a992056848144fcb4b56e1571be9891ae55c0c1a1532d255f8c5fa2914e153a76b2a6bf834157aac7d43902c591
SSDEEP 12288:ahbHjfXLMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:ahbHjPgUjO7l86h/GaYBBPrZNxbc
TLSH
T1FA55023E2AAC10C9E676D67D9691410BC370B8651B12A7DF23D582790F3BEE46C39F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 df8810987761d4324decafea5cd4f010351ee4a818899fcaf4046a693473922f
MD5 7027ad1551ca83f1d9c794930baca8a8
SHA1 20d6c1dea6e7e2878d58ef7ed2e99156e2d5db98
SHA512 5ed1348f34c70decef848ff2a1879dc2c7a1afda9a256693147112cddd27a9e352852fa6b9597330440446ba5993e1956e07f579ba886954af9d15ffb1ea295c
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/YUjO7l86h/GaYBBPrZNxbc:fIgnaTk46pBR/YmO7qS/mLHxbc
TLSH
T13045BF2EF2B910B9D8AAD236450143B5FB71742D1F209ACB0174C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 372fdbfa14dc58384ef2ee1612935240dba2bf812142134de25ed790063a84d5
MD5 60e50c0a4d26938d5c161d01261ff4d6
SHA1 a393ec4fb925d134781e2b58f5827b0435ed8681
SHA512 91364c72c4eff2c696aeb0c8ed59e8ab39691cf39d924c2e3051c7c0db397594975d2f8a064a7a3a8b8dd95bcebe70bdd12ebaf25b701408d7e9d73ee8795da7
SSDEEP 12288:wAMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:wfUjO7l86h/GaYBBPrZNxbc
TLSH
T1C3452316BC554CCAEF09CFB1D280016B4090B0B95F176DCFB1ADBAA4477E8E6747D948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 29195465292168992d3c6ed6d9a5488ec193a27a85f2c667f60a80f39305e64a
MD5 7c0d284e7c9b0bb2aa1cfc6119d9098c
SHA1 7769fc0eaf738704ad71fe55254d9f3c2bbde3be
SHA512 5f12aa74494ae677e1b0f7e506d2685747212f57e6ec00fcfc8bd8d4660a89d54707a4c0b5219ca5e1c1c62c5113ec7d426cb0cb2dd531fe17ea582786533d16
SSDEEP 12288:qOb9A4LWOsvAYFT5MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:bpL3UTKUjO7l86h/GaYBBPrZNxbc
TLSH
T18775F115FAA404F9E96BC13CC9A28617D2B1B49D0764E7DF03A84B651F237E25E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 edc17c18026b37422a609041d0d1b0cc2010c01e1b071bf032b4cf285e2d6c3f
MD5 0f543064c5c40d22df6b22321f5c3c77
SHA1 e65c63fcd83a60588b71460b7704b28876492f83
SHA512 95ef93ad0fe5052cef1904e7d258d66aec414f9a3ca9f02151c54e1a489626a0fb7957b66e3cfa5095e7f4075ca31d8282ddbf1d6fedeb6ced5090ea20b5775a
SSDEEP 12288:ApFtpO1MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:COGUjO7l86h/GaYBBPrZNxbc
TLSH
T13055021A3AED10D5E53A963DC692420EC3B0B4661B2257DF42E081BD4F77EF86C3EA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1879324c7b51bd0d5877e82e3e55202fee83b23a352f66a487d2b2833e95e3a5
MD5 5c47c17ee605143ae29c2a459864ab0e
SHA1 753d1509f611aaebfb0b7cb297b618fa9d6358ca
SHA512 275e4313872c338241a405807b843c46dad77d8cb5de4ff5d947cfd568d8f37f48e9b37358b7268e2d5f8628034334f1ff244008f6b142a4088c95ea75a76861
SSDEEP 24576:p7NM9YqZqmWMUkPjZM48Mv6bEhsjUjO7l86h/GaYBBPrZNxbc:p7cBWMpPjN8DbEhAmO7qS/mLHxbc
TLSH
T14A65AE2E6BAC81D5D577D13DC9A28206F2F1B4611B318ACF1162833E6F37AE45E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 5cd856382ad2f45cf57ab8540efaa95e47596d1995dc8b9eb6f213e6d151e612
MD5 1973f1995e6e6372377adaf0f7605124
SHA1 441a016498ad161bac73734591ac950a336b7779
SHA512 61778df5a309b49610a5577dd38c86eeee049683e753b40fa9aeca440b0843905488429417939e1db2567ae048fb3cd59cb832f849ce04e68ba272bd19af3179
SSDEEP 49152:7F2YuHNETovAvNYf8kmDmO7qS/mLHxbc:a6BCf8kGZ/shc
TLSH
T175858E2A27ED80A4E0BBD27D45B6D246FAB2B8511B3055CF4255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 204744f5e1022820d07f2eeafc2a7d10786f04f5389de10894720cf6c77383c4
MD5 4207babb5ef1d63ae1234b739d6bb154
SHA1 32adc77fe1fe1229d7976b00a43de56da0a94fcd
SHA512 a4bad4294e7730b2bfdc795663af9e3701c11b37a6d58c9cf8c791641b4e8c7a20adb91bebb024d2e57d46662eba783145c9df0a512403c87175bc05b264713e
SSDEEP 24576:PAFs06+Omlf3NXEbToSUjO7l86h/GaYBBPrZNxbc:YFs060lVXutmO7qS/mLHxbc
TLSH
T17A65BF2F66AC00D5D07ED17D8A97C91AF2B1746307255ACF0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 875f721260830069a9173f2b03d3ed3bdceee96a0a1647c59a9ba0a09c200f04
MD5 1d5ade0a22033e0978a9e5d7cba81d81
SHA1 11b4a7c6086e0df7b1a37c7e7260d0c5f89d2e99
SHA512 d9a59c295eec6fb218cfdb5387ff37cab2f8ad6cb8ac417f4309e6430c3089d6ee6c53acb0aeb189e64855ea0181a2d146c70a88c50c25d0b048af94f91057d5
SSDEEP 12288:dCJnJ5D3VkrDzx0MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:0JnJ5D3WXtUjO7l86h/GaYBBPrZNxbc
TLSH
T14D75D02DD2A810E8D4B7C274829A1756FE71347D2F226ECB24B4D5353F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 77487b526efdea6d45fe0eee8c146d60c195666569fabe36bd367ff8a7806127
MD5 594a98576d14fdb2dc5089d56b95ba4d
SHA1 b06c566a1bc2224b1d18a5078f1fbe79ca3fd630
SHA512 445da64819a94c9103dcb24af7bbd0d7a4de2febbb5061165d82d3151ccc974008321e36333b9f2262193b04309c4e5df6c986e15fe4e5e6d8bb8f7f4978a819
SSDEEP 49152:hg06DIKdwc+eQnSt65aVHmO7qS/mLHxbc:qBZ/shc
TLSH
T1B1956C15BBEA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 feac83417df4ba407babd9df26a9b04d1e797fef6530387bfa3839ccf62b2325
MD5 cbf45617c1bb7777a66d4174e6cb0e44
SHA1 6fe2281be151bc452be2f0d701d9b7bd6d45dcba
SHA512 fd88d0899f6ca36bc62d9e87ceb68f3e5d5c6f96fc0352458deb2c71e95c71a6369149fb155393fc3a486d6bb0a53a91b3c52385f231fafb10efd39f8f4b3881
SSDEEP 12288:YEP3RnOMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:znpUjO7l86h/GaYBBPrZNxbc
TLSH
T19755122E7AAC60D9D52AD17D9190424AC3B1F0B52B126BDF52E5C27D4F3B9E52C3DE00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 e250cbe1723f2c0553a25b7340b6ef07a4d334493cf0d43d4401faf477ce4927
MD5 df8294c5ad33c23707ba5fc71d925e02
SHA1 2549fb71e7ae738a57de651732bd5778e2d956c9
SHA512 a3cd4d8eec2c3667f2a66d63c8f5e58046a50e48ef53e7b0ab72349a8282888eb043556d49bd0acc2002255181e4b7063cc5cdbbb2b4be25386a034394b1ea6c
SSDEEP 12288:Wjky7MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:WIywUjO7l86h/GaYBBPrZNxbc
TLSH
T1C8551205769854C9EA6A4A38D6A201A68670BC705F2197CF61D0FB3D4F3BBE0BC39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a3abcd81da3a95234b23fca5cb1bbd54aaba5d5f120fa7682cc7bfe396345764
MD5 898a73d915cd2ec1e20bc8e903f21584
SHA1 c21c2ed43604a7c21fca30425a392c7546b8434b
SHA512 426a0e7c0d116d22b74b7e5c97397f110c78bf831d56e37cd6cc36be295aee6038c61860a576d994db964ac26d4b5e7a807aa31cbf73bc1c11be8918f977276c
SSDEEP 12288:WylMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:/WUjO7l86h/GaYBBPrZNxbc
TLSH
T11345231E7C6548CAEE068AB5D250016B40A0B0B96F167DCF71EDEAB0877F4E2743ED48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 36c5631bf957de7acb030a9eb682fc59743ce219745bbdd314f6e87b624cc354
MD5 fb51773b9f35adfbf0a39947d99c28ba
SHA1 d88556a7f34780cb7ee11ebb8f5c85d33861ece6
SHA512 d41f6b142b3987bf654bffef77e6e39d3ee9ded001aa694e60662de3a649cedb71c4f8955ee1fd5a2fc2e8d51aa7e089fc17ad640b4cd2bdcaeb453bda0018ec
SSDEEP 24576:9Q9MxZKdcz9dw3rUjO7l86h/GaYBBPrZNxbc:9VKZrmO7qS/mLHxbc
TLSH
T119557C2DABE9058AE177D27595A240C3A673B4311B31D6CF2448D03D4E7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 72e3356390110ac43d7e507bec06e7258a51f25b3db98666c45e4112106bda8f
MD5 e5c940e2fa19eed6cea07a60a40287c7
SHA1 4f43523bbf9af166a44f883e713a3f8f195cc358
SHA512 94befda367059737221e998b902ccbd8d23104a246391e07eb00061c0d5fd5d0b91b7e79b492a329b95f824baec622ba42826246599ce4a43f75baca7b82fbb1
SSDEEP 12288:7yoKo2JRple9pnMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:7yocDApMUjO7l86h/GaYBBPrZNxbc
TLSH
T1CE65E01FBB6D40E2E166813C89858346E3B3B0745B6267CB6291C73D4F679E9BC38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d646c2f987eb1c2f471d276a5b460051f3271488161b5630eae21a384127f169
MD5 0420943764b3ed21af07ef12505c4532
SHA1 a814c74f2c26987315a9b74b1abe21c63524ea22
SHA512 aab763f44f8975d519569999f4439007f0e00cba0412c9bfead307623469792f58d9a4b7f252ec00b313ea063c96210367873999b0e75fe9eea20e3348f21678
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKMmO7qS/mLHxbc:50zuNIKZ/shc
TLSH
T1C4A57C3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dd2236ee228fe33b92bccaf1f63e8296927b4484d564a0716d1c269108913337
MD5 14474dd23858e376573904bb97cad137
SHA1 c34383bb5fd358b37574a2a5d62ca4847ce4114e
SHA512 079ffbb964e05cfb6d9fbdaa580eb304bbf0389e1e9d8d9e164965c6e93c5eb7035e6882e98a652f9d94dc1c37582be1fc327a6e4d34c11419f704b9d6dac0f7
SSDEEP 24576:L1QT7EcpfxR+N5AWAz3ooiYtjMqbpUjO7l86h/GaYBBPrZNxbc:2TDxR+N5YzTfjMmmO7qS/mLHxbc
TLSH
T19355B02EA7F805E9D17EC5799A238512FA727861073193CF42A0C17E0F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 65a7c3ac69d3f226e04bf283bd175e07084fde8138d8b606ef7596f7be6ca965
MD5 4a33d29230aa2413705001eaca414187
SHA1 21b1d6141e8032e13acbfe90744a91571fbf415b
SHA512 ed0deca92626fb3e82234523abfc23773837c2a42e8dc161b8045266c99d4dd1e29ae47d263af75e30fceb2fc5546d4d18278b83ded8652ae8fe521c644733e1
SSDEEP 24576:5TMdOz0FFS+imSL1UjO7l86h/GaYBBPrZNxbc:T0K+imSL1mO7qS/mLHxbc
TLSH
T13C75E13EA76D04E5E57BC27DD6438906E67274660322AACB02D0C1792F5BEE4793DF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 6766391294337167e1258d2222d71c47ef1a29308676bff7ced799d7cba005a6
MD5 c0a37aba6e375c1dc8b06070ec2fab3a
SHA1 a60e93f78f99f86c0bf18e10ff4acb474f580b48
SHA512 12088f9dc049ac0697519f68fd17ce94fb88177f8fb88cb07b512d04fe4e46e6650bb956b9d40420901badb12e1606ae8ec4419e2044431c6fde232ee5e80fb0
SSDEEP 12288:64K5MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:AKUjO7l86h/GaYBBPrZNxbc
TLSH
T1E555230D7AE824C8F926C674D761015B8170F47627226AEF31E4DAB94F3B9D4A83DF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-151-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/624-222-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/624-141-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/624-147-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/964-175-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/964-11-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1032-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/1032-511-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/1032-1-0x0000000002200000-0x0000000002267000-memory.dmp

Download

memory/1032-6-0x0000000002200000-0x0000000002267000-memory.dmp

Download

memory/1032-150-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/1844-167-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1844-172-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/1844-176-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1844-229-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1988-92-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1988-121-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1988-71-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1988-131-0x0000000001A40000-0x0000000001AA0000-memory.dmp

Download

memory/1988-134-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2116-216-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2116-137-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/2404-259-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/2404-585-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2404-438-0x000000000C980000-0x000000000C988000-memory.dmp

Download

memory/2404-243-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2404-275-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2404-315-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2444-226-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2444-489-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2492-37-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2492-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2492-31-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2492-196-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2640-182-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2640-242-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2640-436-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2772-233-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2772-179-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/2820-185-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/2820-353-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3292-225-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3292-161-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3292-165-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3292-153-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3308-560-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3308-234-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3452-461-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-447-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-479-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-478-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-477-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-476-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-475-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-474-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-473-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-472-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-471-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-470-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-469-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-468-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-467-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-466-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-465-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-464-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-463-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-462-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-458-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-460-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-459-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-457-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-449-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-453-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-454-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-456-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-455-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-450-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-452-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-451-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-448-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-441-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-480-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-443-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-444-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-445-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-446-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3452-442-0x000002616BFE0000-0x000002616BFF0000-memory.dmp

Download

memory/3536-223-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3536-440-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3664-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3664-210-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3664-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3664-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3700-219-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3700-217-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3820-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3820-135-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3936-390-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3936-197-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3936-188-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3936-194-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4048-211-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4048-201-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4048-207-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4048-413-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4608-557-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4608-230-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4908-214-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4908-433-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/5100-23-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/5100-15-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/5100-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download